FltIsEcpFromUserMode function (fltkernel.h)
The FltIsEcpFromUserMode routine is used to determine if an extra create parameter context structure (ECP) originated from user mode.
Syntax
BOOLEAN FLTAPI FltIsEcpFromUserMode(
[in] PFLT_FILTER Filter,
[in] PVOID EcpContext
);
Parameters
[in] Filter
Opaque filter pointer for the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.
[in] EcpContext
Pointer to the ECP to test.
Return value
The routine returns TRUE if the ECP originated in user mode and FALSE if the ECP originated in kernel mode.
Requirements
Requirement | Value |
---|---|
Minimum supported client | This routine is available starting with Windows Vista. |
Target Platform | Universal |
Header | fltkernel.h (include Fltkernel.h) |
Library | FltMgr.lib |
DLL | FltMgr.sys |
IRQL | <= APC_LEVEL |